Merge remote-tracking branch 'origin/main' into codex/p0-006-ai-log-triage-20260709

apps/api/src/services/agent_market_discovery_classifier.py

@@ -2,10 +2,10 @@
 Agent market discovery classifier
 =================================
 
-Classifies AI controlled discovery repositories from primary GitHub
+Classifies AI controlled discovery candidates from supplied primary-source
 metadata. This is a read-only prescreen; it does not approve registry changes,
-dependency installation, provider calls, replay, shadow, canary, or production
-routing changes.
+dependency installation, provider calls, replay, shadow, canary, production
+routing changes, or GitHub live metadata reads.
 """
 
 from __future__ import annotations
@@ -37,7 +37,7 @@ def run_agent_market_discovery_classification(
         "generated_at": generated_at or datetime.now(timezone.utc).isoformat(),  # noqa: UP017
         "inputs": {
             "discovery_review_generated_at": discovery_review.get("generated_at"),
-            "metadata_source": "github_repository_api_summary",
+            "metadata_source": "supplied_primary_source_metadata_or_policy_blocked_stub",
         },
         "policy": {
             "auto_watch_registry_addition_approved": False,

apps/api/src/services/agent_market_watch.py

@@ -85,6 +85,12 @@ def run_agent_market_watch(
 
     changed_candidates = sum(1 for candidate in candidates if candidate["changed"])
     watch_only_candidates = sum(1 for candidate in candidates if not candidate["changed"])
+    policy_skipped_sources = sum(
+        1
+        for candidate in candidates
+        for source in candidate.get("sources") or []
+        if source.get("status") == "skipped_by_policy"
+    )
 
     return {
         "schema_version": "agent_market_watch_report_v1",
@@ -104,6 +110,7 @@ def run_agent_market_watch(
             "watch_only_candidates": watch_only_candidates,
             "integration_queue_count": len(integration_queue),
             "failure_count": len(failures),
+            "policy_skipped_source_count": policy_skipped_sources,
         },
         "candidates": candidates,
         "integration_queue": integration_queue,
@@ -232,6 +239,21 @@ def _evaluate_source(
             "reference_version": reference_version,
             "error": None,
         }
+    if _is_policy_blocked_source(source_type, url):
+        return {
+            "source_id": source_id,
+            "type": source_type,
+            "url": url,
+            "status": "skipped_by_policy",
+            "http_status": None,
+            "version": reference_version,
+            "published_at": None,
+            "content_hash": None,
+            "changed_since_reference": False,
+            "reference_version": reference_version,
+            "error": None,
+            "policy_blocker": "github_global_freeze_no_github_api_or_github_web_reads",
+        }
 
     fetched = fetcher(url, timeout_seconds)
     previous = previous_sources.get((candidate_id, source_id), {})
@@ -285,6 +307,13 @@ def _is_github_rate_limited(url: str, fetched: FetchedSource) -> bool:
     return "rate limit" in body or "api rate limit exceeded" in body
 
 
+def _is_policy_blocked_source(source_type: str, url: str) -> bool:
+    if source_type in {"github_release", "github_tags", "github_search"}:
+        return True
+    host = urlparse(url).netloc.lower()
+    return host in {"github.com", "www.github.com", "api.github.com"}
+
+
 def _parse_source(source_type: str, body: bytes) -> dict[str, str | None]:
     if source_type == "pypi":
         payload = _loads_json(body)
@@ -335,7 +364,19 @@ def _fetch_discovery_source(
     timeout_seconds: int,
 ) -> dict[str, Any]:
     source_id = str(source.get("source_id", "")).strip()
+    source_type = str(source.get("type", "")).strip()
     url = str(source.get("url", "")).strip()
+    if _is_policy_blocked_source(source_type, url):
+        return {
+            "source_id": source_id,
+            "type": source.get("type"),
+            "url": url,
+            "status": "skipped_by_policy",
+            "http_status": None,
+            "items": [],
+            "error": None,
+            "policy_blocker": "github_global_freeze_no_github_api_or_github_web_reads",
+        }
     fetched = fetcher(url, timeout_seconds)
     result: dict[str, Any] = {
         "source_id": source_id,

apps/api/src/services/awoooi_priority_work_order_readback.py

@@ -741,6 +741,30 @@ _COMMANDER_INSERTED_REQUIREMENT_WORK_ITEMS: list[dict[str, Any]] = [
         "next_action": "將每個 P0 runbook 補齊 AI controlled repair loop 欄位。",
         "mapped_workplan_id": "P1-006",
     },
+    {
+        "id": "CIR-P1-AI-002",
+        "priority": "P1",
+        "order": 40,
+        "status": "in_progress",
+        "lane": "agent_market_research_version_lifecycle",
+        "request": "把目前市場上所有主流且專業的 AI Agent 完整研究、評估導入整合，且目前 AI Agent 版本是否需要更新/更版要納入定期排程。",
+        "normalized_work_item": (
+            "AI Agent market governance：OpenAI Agents SDK、LangGraph、Google ADK、Microsoft Agent Framework、"
+            "CrewAI、LlamaIndex AgentWorkflow、Pydantic AI、AWS Strands、AutoGen legacy migration、"
+            "NVIDIA NeMo/Nemotron、Claude Agent SDK 等主流候選都要進入 primary-source watch、"
+            "integration review、offline replay gate、version lifecycle proposal 與 no-write update cadence。"
+        ),
+        "current_state": (
+            "已開始補 agent-market / ai-technology registries、GitHub-freeze policy skip、replacement candidates "
+            "與版本生命週期 proposal；正式整合仍需 replay / shadow / canary / cost / security evidence。"
+        ),
+        "acceptance": (
+            "Work Items、Agent Market Watch、AI Technology Watch 與 Agent Version Lifecycle API 可讀回候選清單、"
+            "版本 baseline、排程 cadence、GitHub-freeze 邊界與下一個 offline replay / update proposal gate。"
+        ),
+        "next_action": "跑 registry/schema/test 驗證後推 Gitea，讀回 production API/UI，確認此項出現在 Work Items。",
+        "mapped_workplan_id": "P1-006",
+    },
     {
         "id": "CIR-P1-KM-001",
         "priority": "P1",